2

Is there a way to mimic powershell's Get-AzureADUser to read AD properties on given users without having to register the C# console app I am trying to build with Azure?

I know you can run powershell in C# but I am wondering if there is a different route I can take to achieve the same thing WITHOUT registering the app?

Alex
  • 2,247
  • 1
  • 27
  • 37

1 Answers1

1

Short Answer: No. You will need to register an application with Azure AD to be able to authenticate.

Longer Answer:

AFAIK all of the OAuth 2.0 grants for authentication supported by Azure AD will require some information about the client (i.e. registered application) that is being used to make the authentication call. This would be true whether you use ADAL Libraries or directly hit the relevant token/authorization endpoints.

You may already know but it's worth mentioning that the simplest and recommended way to do authentication/query user data with right privileges will be to register your application with Azure AD.

In fact default setup for Azure AD, is such that it promotes the use case of developers being able to register applications and consent to applications on their own behalf. Read here.. Who has permission to add applications to my Azure AD instance? and at the end it mentions that Microsoft itself uses the same configuration internally.

Full Disclosure: I know that some very knowledgeable people (Microsoft MVP's, Microsoft Azure AD team members) follow the azure-active-directory tag. So even though I think this is the right answer, your question is such that it would make sense to wait for more answers/comments to see if there is anything else possible.

Possible workaround if it suits your scenario:

In case you don't want to register your application just because you don't have permissions to a specific Azure Active Directory tenant, there may be a workaround possible.

You would still need to register your application but with a different Azure AD tenant or with Azure AD B2C, and then make your application as a multi-tenant. See this SO post for more details.

Rohit Saigal
  • 9,317
  • 2
  • 20
  • 32
  • What model or what architecture are they using that makes it possible with powershell? seems strange to me that it would be possible in one technology but not in others. thanks for your help! – Alex Jan 14 '19 at 22:42
  • I think even PowerShell would follow something similar only.. and if I'm not wrong there is an application ID associated with it.. It just may not be visible as usual applications that we register.. I'll need to look a little further to get more details on this though – Rohit Saigal Jan 14 '19 at 22:47
  • 1
    @Alex I looked a little more closely at the request going from PowerShell when you call Get-AzureADUser (the same one that you mention in your question).. You can find out that `appId:"1b730954-1685-4b74-9bfd-dac224a7b894"` is used by PowerShell. So my guess is that there would be a multi-tenant application registered to represent PowerShell as well.. we just don't see it in the regular interfaces/api's. Broader point still being, everything that works with Azure AD to authenticate and query information should have a registered application. – Rohit Saigal Jan 14 '19 at 23:15